> npm, Inc. is a company founded in 2014, and was acquired by GitHub in 2020.
> Headquartered in California, [GitHub] has been a subsidiary of Microsoft since 2018.
https://en.wikipedia.org/wiki/GitHub
I think they're effectively a department that generates a lot of PR. They have paid security staff.
https://jobspresso.co/job/software-engineer-platform-2-2-2-2...
This is a job posting for a security engineer at npm from July 4, that appears filled to me. I'm sure as an organization npm inc. is aware of vulnerabilities in their core product, so there's internal back and forth - the usual stuff.